registry / pockethost-cli / 0.2.1

pockethost-cli@0.2.1

Scaffold deploy-ready PocketHost-backed web apps with a single wizard

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 93 file(s), 110 KB of source, external domains: 127.0.0.1, pockethost.io

Source & flagged code

1 flagged

dist/index.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2import pc from "picocolors";

3import { Command } from "commander";

4import * as clack from "@clack/prompts";

5import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";

6import path from "node:path";

7import { Eta } from "eta";

8import prettier from "prettier";

9import { execa } from "execa";

10import { existsSync } from "node:fs";

11import semver from "semver";

12import { fileURLToPath } from "node:url";

13//#region src/core/layers.ts

14function evaluateCondition(expression, data) {

15 const negated = expression.startsWith("!");

16 const value = (negated ? expression.slice(1) : expression).split(".").reduce((current, key) => current?.[key], data);

17 const truthy = Array.isArray(value) ? value.length > 0 : Boolean(value);

18 return negated ? !truthy : truthy;

19}

20async function loadLayer(dir) {

21 const manifestPath = path.join(dir, "layer.json");

22 let raw;

23 try {

24 raw = await readFile(manifestPath, "utf8");

25 } catch {

26 throw new Error(`Template layer is missing layer.json: ${dir}`);

27 }

28 const manifest = JSON.parse(raw);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L8

Source & flagged code

1 flagged · loading source

dist/index.jsView file

8import prettier from "prettier"; L9: import { execa } from "execa"; L10: import { existsSync } from "node:fs"; ... L27: } L28: const manifest = JSON.parse(raw); L29: if (!manifest.name) throw new Error(`layer.json must declare a name: ${manifestPath}`); ... L105: version: "0.0.1", L106: private: true, L107: type: "module" ... L252: function describe(error) { L253: if (error && typeof error === "object" && "stderr" in error && error.stderr) return String(error.stderr).split("\n")[0] ?? String(error); L254: return error instanceof Error ? error.message : String(error);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L8

Findings

1 High2 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2import pc from "picocolors";

3import { Command } from "commander";

4import * as clack from "@clack/prompts";

5import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";

6import path from "node:path";

7import { Eta } from "eta";

8import prettier from "prettier";

9import { execa } from "execa";

10import { existsSync } from "node:fs";

11import semver from "semver";

12import { fileURLToPath } from "node:url";

13//#region src/core/layers.ts

14function evaluateCondition(expression, data) {

15 const negated = expression.startsWith("!");

16 const value = (negated ? expression.slice(1) : expression).split(".").reduce((current, key) => current?.[key], data);

17 const truthy = Array.isArray(value) ? value.length > 0 : Boolean(value);

18 return negated ? !truthy : truthy;

19}

20async function loadLayer(dir) {

21 const manifestPath = path.join(dir, "layer.json");

22 let raw;

23 try {

24 raw = await readFile(manifestPath, "utf8");

25 } catch {

26 throw new Error(`Template layer is missing layer.json: ${dir}`);

27 }

28 const manifest = JSON.parse(raw);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L8